---
id: CVE-2026-52981
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  neigh: let neigh_xmit take skb ownership

  neigh_xmit always releases the skb, except when no neighbour table is
  found
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  neigh: let neigh_xmit take skb ownership

  neigh_xmit always releases the skb, except when no neighbour table is
  found. But even the first added user of neigh_xmit (mpls…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
published: '2026-06-24'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52981'
references:
  - url: 'https://git.kernel.org/stable/c/0084712e0bee204b284510cdb63182fd5a30c2b7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4438113be604ee67a7bf4f81da6e1cca41332ce4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/445e45a2c3a078316a62d2d331a570cf34ef5079'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/63063ba60d2dc334e34f1e3f9271d7f3f6f30307'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8a89054a1ec0767aec25ed2bbac933da6ba3cf5a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/9247d59ca15bf60a57dca08103f055d8a4340877'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00728
epssPercentile: 0.52211
ingestedAt: '2026-07-11T13:13:25.443Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

neigh: let neigh_xmit take skb ownership

neigh_xmit always releases the skb, except when no neighbour table is
found. But even the first added user of neigh_xmit (mpls) relied on
neigh_xmit to release the skb (or queue it for tx).

sashiko reported:
 If neigh_xmit() is called with an uninitialized neighbor table (for
 example, NEIGH_ND_TABLE when IPv6 is disabled), it returns -EAFNOSUPPORT
 and bypasses its internal out_kfree_skb error path.  Because the return
 value of neigh_xmit() is ignored here, does this leak the SKB?

Assume full ownership and remove the last code path that doesn't
xmit or free skb.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.